jeecgboot/JeecgBoot · error · IllegalArgumentException

文件路径包含非法字符，已拒绝处理:

Error message

文件路径包含非法字符，已拒绝处理: 

What it means

Thrown by CommandExecUtil.validateFilePath(String) when a file path contains characters matched by FILENAME_INJECTION_PATTERN: & | ; < > ` $ ! " ' \r \n. Unlike validateArg, this pattern allows backslashes (needed for Windows paths) but additionally blocks quotes. It is a security guard against filename injection when paths are passed to external commands.

Source

Thrown at jeecg-boot/jeecg-boot-module/jeecg-boot-module-airag/src/main/java/org/jeecg/modules/airag/llm/handler/CommandExecUtil.java:68

     *
     * @param arg 待校验参数
     * @throws IllegalArgumentException 若参数包含危险字符
     */
    public static void validateArg(String arg) {
        if (arg != null && SHELL_INJECTION_PATTERN.matcher(arg).find()) {
            throw new IllegalArgumentException("命令参数包含非法字符，已拒绝执行: " + arg);
        }
    }

    /**
     * 校验文件路径，拒绝包含危险字符（防止文件名注入）
     *
     * @param filePath 待校验文件路径
     * @throws IllegalArgumentException 若文件路径包含危险字符
     */
    public static void validateFilePath(String filePath) {
        if (filePath != null && FILENAME_INJECTION_PATTERN.matcher(filePath).find()) {
            throw new IllegalArgumentException("文件路径包含非法字符，已拒绝处理: " + filePath);
        }
    }

    /**
     * 执行命令行
     *
     * @param command 脚本目录
     * @param args    参数
     * @author chenrui
     * @date 2024/4/09 10:30
     */
    public static String execCommand(String[] command, String[] args) throws IOException {

        if (null == command || command.length == 0) {
            throw new IllegalArgumentException("命令不能为空");
        }

        if (null != args && args.length > 0) {

View on GitHub (pinned to 96fb33f5ec)

Solutions

1. Rename or sanitize the file before calling validateFilePath — strip or replace blocked characters in the filename portion only.
2. If the file comes from user upload, sanitize the original filename at upload time (in CommonUtils.uploadLocal or equivalent).
3. Use FilenameUtils.getName() to isolate the filename and clean only that portion, preserving the directory path.

Example fix

// before
CommandExecUtil.validateFilePath(docFile.getAbsolutePath());
// throws if filename = data;report.pdf

// after
String safeName = docFile.getName().replaceAll("[&|;<>`$!\"'\\r\\n]", "_");
File safeFile = new File(docFile.getParentFile(), safeName);
CommandExecUtil.validateFilePath(safeFile.getAbsolutePath());

String safePath = filePath == null ? null
    : filePath.replaceAll("[&|;<>`$!\"'\r\n]", "_");
CommandExecUtil.validateFilePath(safePath);

private static boolean isSafeFilePath(String path) {
    return path == null || !Pattern.compile("[&|;<>`$!\"'\r\n]").matcher(path).find();
}

try {
    CommandExecUtil.validateFilePath(filePath);
} catch (IllegalArgumentException e) {
    log.warn("Rejected file path with dangerous characters: {}", e.getMessage());
    throw new JeecgBootException("文件名包含非法字符，请重命名文件");
}

When it happens

Trigger: Calling validateFilePath on a path containing any of the blocked characters. For example: a file named data"report.pdf, a path with a semicolon (common in some generated temp names), or a file containing single quotes in its name.

Common situations: User-uploaded file with special characters in the original filename; a downloaded web resource whose URL-derived filename contains a semicolon or quote; OS-generated temp paths containing restricted characters.

Related errors

• 命令参数包含非法字符，已拒绝执行:
• 非法存储路径，路径包含遍历字符: {storePath}
• 请注意，值可能存在SQL注入风险!--->{value}
• 请注意，SQL中不允许含注释，有安全风险！
• 请注意，值可能存在SQL注入风险---> \*.*\

AI-assisted analysis of jeecgboot/JeecgBoot@96fb33f5ec (2026-08-14). Data as JSON: /api/errors/b46397237dc15d04. Report an issue: GitHub.